pfSense & OPNsense to Graylog
Firewall logs are some of the most valuable data a Graylog instance can hold — every blocked packet, every NAT decision, every VPN handshake. Both pfSense and OPNsense are FreeBSD-based and ship built-in remote syslog forwarding, so neither needs an agent: you point them at a Graylog Syslog input and they stream their logs straight in. This guide covers both firewalls, the FreeBSD truncation pitfall that catches everyone, and how to get clean, parsed fields out the other side.
Before either firewall can send anything, Graylog needs somewhere to listen. Create a dedicated Syslog UDP input so firewall traffic lands on its own port — this makes it easy to route and parse separately from other log sources later.
| Step | Action |
|---|---|
| 1 | Go to System / Inputs, select Syslog UDP, click Launch new input |
| 2 | Tick Global, set Bind address to 0.0.0.0 and Port to 5140 |
| 3 | Save, then confirm the input shows as running |
127.0.0.1, which blocks remote firewalls. Publish the port on a routable interface — change the mapping to "5140:5140/udp" (drop the 127.0.0.1: prefix) and run docker compose up -d to recreate the container.Both firewalls run FreeBSD, and its native syslog daemon truncates each message at roughly 480 bytes. For plain firewall (filterlog) events that's usually fine, but verbose sources — Suricata/Snort alerts, detailed NAT logs — get cut off mid-line and parse incorrectly.
| If you need… | Use |
|---|---|
| Basic firewall + system logs, UDP | The built-in remote syslog (covered below) — simplest, no packages |
| Long messages, TCP, or TLS | The syslog-ng package, which replaces the truncating daemon |
pfSense exposes remote logging in the web UI — no shell access required for the basic setup. Navigate to Status → System Logs → Settings and scroll to the Remote Logging Options section.
| Field | Value |
|---|---|
| Enable Remote Logging | Checked |
| Source Address | Default (Any) — or your LAN interface if Graylog is across an IPsec tunnel |
| IP Protocol | IPv4 (match your Graylog reachability) |
| Remote log servers | your-graylog-ip:5140 |
| Remote Syslog Contents | Everything (or tick only Firewall Events to start) |
Click Save. Firewall logs should appear in Graylog's Search within seconds — expect a flood of filterlog entries if firewall logging is enabled.
host:port. If no port is given, pfSense assumes 514. Keep the :5140 suffix so it matches the input you created.If you're forwarding Suricata/Snort or other verbose logs, install the syslog-ng package (System → Package Manager → Available Packages) to bypass the 480-byte limit and gain TCP. After install it appears under Services → Syslog-ng.
| Field | Value |
|---|---|
| Enable | Checked |
| Log destination | Add a destination: Graylog IP, port 5140, transport UDP or TCP |
| Log source / object | Bind the system log source to the new destination via a Log object |
OPNsense uses syslog-ng as its core logging engine, so remote forwarding is built in and supports UDP, TCP, and TLS without installing anything. Go to System → Settings → Logging / Targets and add a new target.
| Field | Value |
|---|---|
| Enabled | Checked |
| Transport | UDP(4) — or TCP(4) / TLS(4) for reliable or encrypted delivery |
| Applications | Nothing selected = forward all applications |
| Levels | Nothing selected = all, or pick info / notice / warn / error / critical… |
| Facilities | Nothing selected = all facilities |
| Hostname | your-graylog-ip |
| Port | 5140 |
| Description | e.g. Graylog syslog |
Click Save, then Apply to activate the target. Logs begin flowing to Graylog immediately; check Search to confirm.
filterlog for firewall events only) once you've confirmed data is arriving.Raw firewall logs arrive as a single unstructured string — the filterlog CSV is packed with fields (interface, action, direction, protocol, source/dest IP and port) that Graylog won't split automatically. Three options, easiest to most involved:
| Method | What it does |
|---|---|
| Illuminate content pack | Graylog's official pfSense/OPNsense security pack: parsing rules, a stream, an index set, and dashboards. Easiest if you have Illuminate. |
| Community content pack | Open-source packs (e.g. the pfsense-graylog repo) bundle an input, extractors, and lookup tables you import under System / Content Packs. |
| Manual extractors | Import a filterlog extractor JSON onto the input via Manage extractors — splits the CSV into searchable fields. |
gl2_source_input ID, then set content_name = pfsense_firewall and that input ID in the lookup_adapter_input_routing table. This tags incoming messages as pfSense/OPNsense so the pack processes them correctly.Firewall logs are high-volume, so give them their own index set and retention rather than mixing them into the default index. This keeps searches fast and lets you age firewall data out independently.
| Step | Action |
|---|---|
| 1 | System / Indices → create an index set named e.g. Firewall Logs, index prefix firewall |
| 2 | Set rotation/retention to taste (a common choice: daily rotation, 90 days retained) |
| 3 | Streams → create a Firewall stream, rule: source matches your firewall (or message contains filterlog) |
| 4 | Point the stream at the new index set; tick Remove from Default Stream so events land only in the firewall index |
| Symptom | Check |
|---|---|
| No messages at all | Input running & Global? Port published (not bound to 127.0.0.1 in Docker)? Firewall-to-Graylog path open? |
| Input shows 0 received | Port/protocol must match exactly — firewall sends UDP 5140, input listens UDP 5140 |
| Messages cut off mid-line | FreeBSD 480-byte truncation — switch that source to syslog-ng (TCP) |
| Logs arrive but no fields | No extractor/content pack applied yet — see section 06 |
| Quick listener test | echo "<34>test from firewall" | nc -u -w1 your-graylog-ip 5140 |
| Watch input live | System / Inputs → Show received messages on the firewall input |
| Item | Value |
|---|---|
| Graylog input type | Syslog UDP (or TCP via syslog-ng) |
| Suggested port | 5140/udp |
| pfSense settings page | Status → System Logs → Settings → Remote Logging Options |
| pfSense TCP/long messages | Services → Syslog-ng (install package first) |
| OPNsense settings page | System → Settings → Logging / Targets |
| FreeBSD syslogd limit | ~480 bytes per message (built-in daemon only) |
| Common parser | Illuminate pfSense/OPNsense pack, or community filterlog extractors |